PT-2022-3194 · Siemens · Teamcenter

Published 2022-05-10 · Updated 2023-02-23 · CVE-2022-29801

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Teamcenter versions prior to V12.4.0.13 Teamcenter versions prior to V13.0.0.9

Description The issue is related to incorrect restriction of XML links to external objects, which could allow an attacker to conduct XML External Entity (XXE) attacks. This vulnerability may enable a remote attacker to view files on the application server filesystem.

Recommendations For Teamcenter versions prior to V12.4.0.13, update to version V12.4.0.13 or later. For Teamcenter versions prior to V13.0.0.9, update to version V13.0.0.9 or later. As a temporary workaround, consider restricting XML external entity usage until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2022-03879

CVE-2022-29801

Affected Products

Teamcenter

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-29801 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03879 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29801 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022051123 · Note
• https://t.me/cibsecurity/43028 · Telegram Post